Chronos-DFIR features a powerful multi-format ingestion engine that accepts forensic artifacts and reports through an intuitive drag-and-drop interface. The system handles files up to 6GB+ using streaming uploads and maintains chain of custody with SHA256 hashing.
Chronos-DFIR provides optimized parsers for native forensic artifacts:
1
Windows Event Logs (EVTX)
Processes Windows Event Logs with automatic extraction of EventID, Level, Provider, Computer, and descriptions. Uses the evtx_engine.py module for binary parsing.Key features:
Direct binary EVTX parsing
Automatic metadata extraction
Windows-specific normalization
2
MFT (Master File Table)
Deep analysis of NTFS filesystem metadata with real FILETIME parsing from $STANDARD_INFORMATION attributes.
Forensic Integrity: As of v179, MFT timestamps are parsed from real FILETIME structures. Never use fabricated timestamps like datetime.now() in forensic analysis.
3
macOS Property Lists (Plist)
Detects and parses macOS Plist files including LaunchAgents and LaunchDaemons used in persistence mechanisms.
# From engine/ingestor.pydef _parse_single_plist(file_path: str) -> pl.DataFrame: import plistlib with open(file_path, 'rb') as fp: plist_data = plistlib.load(fp) # Sanitize values (bytes → hex, nested → str) sanitized = [{k: _sanitize_plist_val(v) for k, v in row.items()} for row in plist_data] return pl.DataFrame(sanitized, strict=False)
# From engine/ingestor.py - Zero-pandas SQLite ingestionimport sqlite3conn = sqlite3.connect(file_path)cursor = conn.cursor()# Auto-detect main table (events, logs, timeline, entries)cursor.execute("SELECT name FROM sqlite_master WHERE type='table';")tables = [r[0] for r in cursor.fetchall() if not r[0].startswith('sqlite_')]cursor.execute(f'SELECT * FROM "{target_table}"')col_names = [desc[0] for desc in cursor.description]rows = cursor.fetchall()df = pl.DataFrame( {col_names[i]: [row[i] for row in rows] for i in range(len(col_names))}, strict=False)
TXT / LOG - Unified logs, syslog, whitespace-separated process lists
For files larger than 6GB, Chronos uses streaming upload to prevent memory saturation:
# From app.py:166-186@app.post("/upload")async def process_file(file: UploadFile = File(...)): file_path = os.path.join(UPLOAD_DIR, file.filename) # STREAMING UPLOAD: Stream directly to disk (6GB+ files) # Chain of Custody: compute SHA256 hash during upload (zero extra I/O) sha256 = hashlib.sha256() with open(file_path, "wb") as buffer: while chunk := file.file.read(8192): # 8KB chunks sha256.update(chunk) buffer.write(chunk) file_hash = sha256.hexdigest() file_size = os.path.getsize(file_path) logger.info(f"Chain of Custody — {file.filename}: " f"SHA256={file_hash}, Size={file_size}")
Zero Overhead: SHA256 hash is computed during the streaming upload with no additional file read operations, maintaining performance even for multi-gigabyte evidence files.
Forensic Standard: The SHA256 hash and file size are computed at ingestion time and should be recorded in your investigation documentation to maintain evidence integrity.
Hardware Optimized: Chronos is optimized for Apple Silicon M4 with ARM NEON vectorization and unified memory architecture. All Polars operations leverage SIMD acceleration.
